How to configure Check Point software to upload data to Check Point / download data from Check Point in versions R81.20 and higher

Solution

Important Note - For Management Server versions R81.10 and lower, see sk111080.

This article describes the Consent Flags in these scenarios for versions R81.20 or higher:

(*) For the supported forward compatibility, see sk113113 - section "Management Servers and Security Gateways they can manage".

Table of Contents:

• (1) Summary of Consent Flags

• (2) Enabling and Disabling the Consent Flags

• (3) Consent Flag Decision Table

• (4) Where the Consent Flags are Stored

• (5) Known Limitations and Warnings

• (6) Troubleshooting

(1) Summary of Consent Flags

Enter the string to filter this table:

Consent Flag	Default Status	Description	Notes
Download Security	Enabled	Controls the download of "Security" data from online Check Point servers: - Allows to update the installed Check Point products that are defined as "Security". For example, CPUSE Deployment Agent, Threat Emulation Engine. - Allows to download data that is defined as "Security". For example, signatures for the IPS Software Blade.	- After an upgrade to R81.20 or higher versions, this Consent Flag keeps the configured value from the previous version.
Download Non-Security	Enabled	Controls the download of "Non-Security" data from online Check Point servers: - Allows to update the installed Check Point products that are defined as "Non-Security". For example, updates for the CPinfo tool. - Allows to download data that is defined as "Non-Security".	- After an upgrade to R81.20 or higher versions, this Consent Flag gets the new default value.
Upload Information	Enabled	Controls the upload of anonymous data to online Check Point servers: - Allows to upload anonymous logs. For example, the upload of logs from the CPUSE tool. - Allows to upload anonymous diagnostics information. For example, the upload of data from the CPinfo and CPUSE tools. Check Point uses this data internally for bug analysis and to improve the products. All data is subject to the European privacy policy (GDPR).	- After an upgrade to R81.20 or higher versions, this Consent Flag keeps the configured value from the previous version. - This Consent Flag has priority over the setting " Sync with User Center" (refer to sk94064). If you enabled the setting " Sync with User Center" (SmartConsole > Manage & Settings > Sync with User Center), but did not enable this Consent Flag, then the Management Server does not synchronize with User Center.
Upload Crash Data	Disabled	Controls the upload of core dump files to online Check Point servers: - Allows to upload core dump files that user space processes create during a failure. - Allows to upload core dump files that Gaia OS creates during a failure. Gaia OS uses the Core File Uploader tool to upload these files. Check Point uses this data internally for bug analysis and to improve the products. Warning - Because core dump files contain a snapshot of the memory, they can contain personal and sensitive information.	- After an upgrade to R81.20: - This Consent Flag (checkbox in SmartConsole) gets the new default value. - The local configuration (on the Security Gateway) of this Consent Flag in Gaia OS is removed. - After an upgrade from R81.20 to R82 or higher versions: - This Consent Flag (checkbox in SmartConsole) keeps the configured value from the previous version. - This local Consent Flag (on the Security Gateway) keeps the configured values from the previous version.

Consent Flag values on a Multi-Domain Security Management Server:

• A newly created Domain copies the initial Consent Flag values from the Global (System) Domain.

• The Global Domain manages the Consent Flags only for the MDS context.

• All other Domains manage the Consent Flags only for themselves and for their manages Security Gateways / Clusters.

Getting Consent Flag values from all managed Security Gateways / Cluster Members:

1. Download this script to your computer.
2. Copy the downloaded script to your Management Server to some directory (for example, /var/log/).
3. Connect to the command line on the Management Server.
4. Log in to the Expert mode.
5. Go to the directory with the script:

cd /var/log

6. Assign the "execute" permission to the script:

chmod -v +x consent_flags_status.py

7. Run the script:

./consent_flags_status.py

Example output:

   [Expert@MyMgmt:0]# ./consent_flags_status.py
   Data Extraction In Progress... Might take a while.....

Upload Flag Status - (1)
       The Upload Flag Is Using The Management Settings - (2)
       Download Security Flag Status - (3)
       The Download Security Flag Is Using The Management Settings - (4)
       Download Non Security Flag Status - (5)
       The Download Non Security Flag Is Using The Management Settings - (6)
       Upload Crash Data Flag Status - (7)
       The Upload Flag Is Using The Management Settings - (8)

-------------------------------------------------------------------------------------------------------------------
   |Gateway Information      |(1)       |(2)       |(3)       |(4)       |(5)       |(6)       |(7)       |(8)       |
   -------------------------------------------------------------------------------------------------------------------
   |                         |          |          |          |          |          |          |          |          |
   |Name: GW-A               |Enabled   |True      |Enabled   |True      |Disabled  |True      |Disabled  |True      |
   |IP: 192.168.3.4          |          |          |          |          |          |          |          |          |
   |Version: R81.20          |          |          |          |          |          |          |          |          |
   |Domain: MyDomain1        |          |          |          |          |          |          |          |          |
   |                         |          |          |          |          |          |          |          |          |
   -------------------------------------------------------------------------------------------------------------------
   [Expert@MyMgmt:0]#

(2) Enabling and Disabling the Consent Flags

You can enable and disable the Consent Flags in these ways:

Important - See "(3) Consent Flag Decision Table".

(2-A) In Gaia First Time Configuration Wizard (FTCW)

On the last page " First Time Configuration Wizard Summary" > at the bottom, click in "Review Update and Data Sharing setting here".

(2-B) In SmartConsole

Notes:

• On a Multi-Domain Security Management Server, you must configure the applicable value for the consent flags also in the Global Domain (in addition to the applicable Domain Management Servers).
• On a Multi-Domain Log Server, you must configure the applicable value for the consent flags also in the Global Domain (in addition to the applicable Domain Log Servers).

Instructions:

1. In SmartConsole top left corner, click the Menu button.

2. Click Global properties.

3. In the left panel, click Data Access Control.

4. Configure the required Consent Flags.

   Consent Flag	Title of the Checkbox in SmartConsole
   Download Security	Automatically download and install Software Blade Contracts, security updates, and other important data (highly recommended)
   Download Non-Security	Automatically download software updates and new features (highly recommended)
   Upload Information	Help Check Point improve the products by sending anonymous information
   Upload Crash Data	I approve sharing core dump files and other relevant crash data which might contain personal information

5. Click OK.

6. Install the Access Control Policy on all managed Security Gateways / Clusters / VSX Virtual Systems / VSX Virtual Routers.

(2-C) In Gaia Clish (local override)

To configure the local values:

Enter the string to filter this table:

Consent Flag	Gaia Clish Command
Download Security	- To override the value configured in SmartConsole: `set consent-flags allow-receiving-data {true
Download Non-Security	- To override the value configured in SmartConsole: `set consent-flags allow-receiving-data-non-security {true
Upload Information	- To override the value configured in SmartConsole: `set consent-flags allow-sending-data {true
Upload Crash Data	- To override the value configured in SmartConsole: `set consent-flags allow-sending-crash-data {true

To view the current local values:

Enter the string to filter this table:

Consent Flag	Gaia Clish Command	Expert Mode Command
Download Security	show consent-flags allow-receiving-data	dbset AllowReceivingDataFromCheckPoint
Download Non-Security	show consent-flags allow-receiving-data-non-security	dbset AllowReceivingDataFromCheckPointNonSecurity
Upload Information	show consent-flags allow-sending-data	dbset AllowSendingDataToCheckPoint
Upload Crash Data	show consent-flags allow-sending-crash-data	dbset AllowSendingSensitiveDataToCheckPoint

(2-D) Priority Order of Consent Flag Values

Server	Priority Order
Management Server	1. The Consent Flag values you configured in the Gaia First Time Configuration Wizard are valid only until the first "Install Database" operation. 2. The Consent Flag values you configured locally (in Gaia Clish) on the Management Server take priority.
Security Gateway / Cluster Member	1. The Consent Flag values you configured in the Gaia First Time Configuration Wizard are valid only until the first policy installation. 2. After the first policy installation, the Consent Flag values you configured in SmartConsole take priority. 3. The Consent Flag values you configured locally (in Gaia Clish) on the Security Gateway / Cluster Member take priority.

(3) Consent Flag Decision Table

The tables below show the final verdict - whether a download / upload is allowed or forbidden.

This final verdict is based on the values of a Consent Flag in different database, that have different priorities.

(3-A) Management Server R81.20 and higher

Show / Hide this section

Enter the string to filter this table:

Row #	Consent Flag initial value from the Gaia OS FTCW on the Management Server	Consent Flag value in the Management Database on the Management Server (in SmartConsole)	Final Verdict - Ability to download / upload on the Management Server	How is this configuration possible?
1	0	true	1 - Management Server is allowed to download / upload.	Not possible - after the Gaia OS FTCW, the initial values in the Gaia OS Database always match the values in the Management Database.
2	1	true	1 - Management Server is allowed to download / upload.	1. An administrator manually enabled the Consent Flag during the Gaia FTCW. 2. An administrator manually enabled the Consent Flag in SmartConsole. 3. An administrator performed the "Install Database" or the "Install Policy" operation.
3	0	false	0 - Management Server is forbidden to download / upload.	1. An administrator manually disabled the Consent Flag during the Gaia FTCW. 2. An administrator manually disabled the Consent Flag in SmartConsole. 3. An administrator performed the "Install Database" or the "Install Policy" operation.
4	1	false	0 - Management Server is forbidden to download / upload.	Not possible - after the Gaia OS FTCW, the initial values in the Gaia OS Database always match the values in the Management Database.

(3-B) Security Gateway R81.20 (or higher) managed by Management Server R81.20 (or higher)

Show / Hide this section

The final verdict in the table below is based on configuration in Gaia OS FTCW and in SmartConsole.

You can change the Consent Flag values locally on the Security Gateway / Cluster Member.

Enter the string to filter this table:

Row #	Consent Flag initial value from the Gaia OS FTCW on the Security Gateway	Consent Flag value in the Management Database on the Management Server (in SmartConsole)	Consent Flag value in the Objects Database on the Security Gateway	Final Verdict - Ability to download / upload on the Security Gateway	How is this configuration possible?
1	1	true	false	1 - Security Gateway is allowed to download / upload.	Not possible. This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members.
2	0	false	true	0 - Security Gateway is forbidden to download / upload.	Not possible. This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members.
3	1	true	true	1 - Security Gateway is allowed to download / upload.	- Before the first policy installation - Security Gateway is allowed to download / upload. - After the first policy installation - Security Gateway is allowed to download / upload.
4	0	true	true	1 - Security Gateway is allowed to download / upload.	- Before the first policy installation - Security Gateway is forbidden to download / upload. - After the first policy installation - Security Gateway is allowed to download / upload.
5	1	false	false	0 - Security Gateway is forbidden to download / upload.	- Before the first policy installation - Security Gateway is allowed to download / upload. - After the first policy installation - Security Gateway is forbidden to download / upload.
6	0	false	false	0 - Security Gateway is forbidden to download / upload.	- Before the first policy installation - Security Gateway is forbidden to download / upload. - After the first policy installation - Security Gateway is forbidden to download / upload.
7	1	false	true	1 - Security Gateway is allowed to download / upload.	Not possible. This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members.
8	0	false	true	0 - Security Gateway is forbidden to download / upload.	Not possible. This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members.

(3-C) Security Gateway R81.20 (or higher) managed by Management Server R81.10 / R81

Show / Hide this section

Notes:

• For the supported forward compatibility, see sk113113 - section "Management Servers and Security Gateways they can manage".
• Management Server R81.10 / R81 supports only these Consent Flags:
  • "Allow Upload" - Allows the upload of data from the machine to Check Point.
  • "Allow Download" - Allows the download of data from Check Point to the Management Server.
• The final verdict in the table below is based on configuration in Gaia OS FTCW and in SmartConsole.

  Enter the string to filter this table:

  Row #	Consent Flag value in the Management Database on the Management Server (SmartConsole)	Consent Flag value in the Registry Database on the Management Server	Consent Flag value in the Objects Database on the Security Gateway	Final Verdict - Ability to download / upload on the Security Gateway	How is this configuration possible?	Comments
  1	false	0	false	0 - Security Gateway is forbidden to download / upload.	- On the Security Gateway and on the Management Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later), and in the Objects Database.	Consent Flags on the Security Gateway are disabled. Consent Flags on the Management Server have priority.
  2	false	0	false	0 - Security Gateway is forbidden to download / upload.	- On the Security Gateway: An administrator manually disabled the Consent Flags in the Objects Database. - On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later).	Consent Flags on the Management Server have priority.
  3	false	0	true	Not possible.	- On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). - On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later).	This scenario can be only temporary because once policy installation is performed, the Security Management Server transfers its configuration information to the Security Gateway.
  4	false	0	true	Not possible.	- On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later).	This scenario can be only temporary because once policy installation is performed, the Security Management Server transfers its configuration information to the Security Gateway.
  5	false	1	false	0 - Security Gateway is forbidden to download / upload.	- On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later), and in the Objects Database. - On the Management Server / Log Server: An administrator manually disabled the Consent Flags in the Objects Database.	Consent Flags on the Management Server have priority.
  6	false	1	false	0 - Security Gateway is forbidden to download / upload.	- On the Security Gateway and on the Management Server: An administrator manually disabled the Consent Flags in the Objects Database.	Consent Flags on the Management Server have priority.
  7	false	1	true	Not possible.	- On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). - On the Management Server / Log Server: An administrator manually disabled the Consent Flags in the Objects Database.	This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members.
  8	false	1	true	Not possible.	- On the Management Server / Log Server: An administrator manually disabled the Consent Flags in the Objects Database.	This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members.
  9	true	0	false	0 - Security Gateway is forbidden to download / upload.	- On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). - On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later).	Consent Flags on the Security Gateway are disabled. Consent Flags on the Management Server have priority.
  10	true	0	false	Not possible.	- On the Security Gateway: An administrator manually disabled the Consent Flags in the Objects Database. - On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later).	This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members.
  11	true	0	true	1 - Security Gateway is allowed to download / upload.	- On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). - On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later).	Consent Flags on the Management Server have priority.
  12	true	0	true	1 - Security Gateway is allowed to download / upload.	- On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later).	Consent Flags on the Management Server have priority.
  13	true	1	false	0 - Security Gateway is forbidden to download / upload.	- On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later), and in the Objects Database.	Consent Flags on the Security Gateway are disabled. Consent Flags on the Management Server have priority.
  14	true	1	false	Not possible.	- On the Security Gateway: An administrator manually disabled the Consent Flags in the Objects Database.	Consent Flags on the Management Server have priority. This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members.
  15	true	1	true	1 - Security Gateway is allowed to download / upload.	- On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later).	Consent Flags on the Management Server have priority.
  16	true	1	true	1 - Security Gateway is allowed to download / upload.	- On the Security Gateway and on the Management Server: Both flags are enabled in the Registry, and in the Objects Database.	Consent Flags on the Management Server have priority.

(3-D) Security Gateway R81.10 (or lower) managed by Management Server R81.20 (or higher)

Show / Hide this section

Notes:

• For the supported backward compatibility, see sk113113 - section "Management Servers and Security Gateways they can manage".
• Security Gateway R81.10 and lower supports only these Consent Flags:
  • "Allow Upload" - Allows the upload of data from the machine to Check Point.
  • "Allow Download" - Allows the download of data from Check Point to the Security Gateway.
• The final verdict in the table below is based on configuration in Gaia OS FTCW and in SmartConsole.

  Enter the string to filter this table:

  Row #	Consent Flag value in the Management Database on the Management Server (SmartConsole)	Consent Flag value in the Objects Database on the Security Gateway	Consent Flag value in the Registry Database on the Security Gateway	Final Verdict - Ability to download / upload on the Security Gateway	How is this configuration possible?	Comments
  1	false	false	0	0 - Security Gateway is forbidden to download / upload.	- On the Security Gateway and on the Management Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later), and in the Objects Database.	Consent Flags on the Security Gateway are disabled. Consent Flags on the Management Server have priority.
  2	false	false	1	0 - Security Gateway is forbidden to download / upload.	- On the Security Gateway: An administrator manually disabled the Consent Flags in the Objects Database. - On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later).	Consent Flags on the Management Server have priority.
  3	false	true	0	Not possible.	- On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). - On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later).	This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members.
  4	false	true	1	Not possible.	- On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later).	This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members.
  5	false	false	0	0 - Security Gateway is forbidden to download / upload.	- On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later), and in the Objects Database. - On the Management Server / Log Server: An administrator manually disabled the Consent Flags in the Objects Database.	Consent Flags on the Management Server have priority.
  6	false	false	1	0 - Security Gateway is forbidden to download / upload.	- On the Security Gateway and on the Management Server: An administrator manually disabled the Consent Flags in the Objects Database.	Consent Flags on the Management Server have priority.
  7	false	true	0	Not possible.	- On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). - On the Management Server / Log Server: An administrator manually disabled the Consent Flags in the Objects Database.	This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members.
  8	false	true	1	Not possible.	- On the Management Server / Log Server: An administrator manually disabled the Consent Flags in the Objects Database.	This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members.

(4) Where the Consent Flags are Stored

Enter the string to filter this table:

Where the Consent Flags are stored?	When the Consent Flags are created?	Comments
$FWDIR/conf/objects_5_0.C (Objects Database)	- On a Security Gateway / Cluster Member, during the first policy installation. - On a Security Management Server / Multi-Domain Security Management Server / Domain Management Server / Log Server, during the first "Install Database" operation.	- Do not edit this file in a text editor.

You must use only SmartConsole, Database Tool (GuiDBedit Tool, sk13009), or dbedit tool ( skI3301).

• The Consent Flag values are stored in the firewall_properties section of this objects_5_0.C file.

• The Consent Flag values are stored in these parameters:

Consent Flag	Parameter Name
Download Security	:allow_download_content (...)
Download Non-Security	:allow_download_non_security_content (...)
Upload Information	:allow_upload_content (...)
Upload Crash Data	:allow_upload_sensitive_content (...)

• To see the current Consent Flag values, run in the Expert mode:

grep -n -E "allow_download_|allow_upload_" $FWDIR/conf/objects_5_0.C

Possible returned values:

• :<Parameter_Name> (false) - download / upload of data is forbidden

• :<Parameter_Name> (true) - download / upload of data is allowed | | /config/db/initial
  (Gaia OS Database) | - On a Security Gateway / Cluster Members / Security Management Server / Multi-Domain Security Management Server / Domain Management Server / Log Server, during the First Time Configuration Wizard.
  
  - On a Security Management Server / Multi-Domain Security Management Server / Domain Management Server / Log Server, during the first "Install Database" operation.
  
  - On a Security Gateway / Cluster Member, when an administrator overrides the central Consent Flag values with the Gaia Clish commands. | - Do not edit this file in a text editor.

You must use only the Gaia Clish commands "set consent-flags".

• The Consent Flag values are stored in these parameters:

Consent Flag	Parameter Name
Download Security	AllowReceivingDataFromCheckPoint AllowReceivingDataFromCheckPointDefault
Download Non-Security	AllowReceivingDataFromCheckPointNonSecurity AllowReceivingDataFromCheckPointNonSecurityDefault
Upload Information	AllowSendingDataToCheckPoint AllowSendingDataToCheckPointDefault
Upload Crash Data	AllowSendingSensitiveDataToCheckPoint AllowSendingSensitiveDataToCheckPointDefault

Note - Parameters with the names that end with "...Default" contain the Consent Flag values received from the Gaia First Time Configuration Wizard. Gaia OS uses these values before the first policy installation or before the local override with the Gaia Clish "set consent-flags" commands.

• To see the current Consent Flag values in Gaia Clish, run these commands:
  • show consent-flags allow-receiving-data
  • show consent-flags allow-receiving-data-non-security
  • show consent-flags allow-sending-crash-data
  • show consent-flags allow-sending-data
• To see the current Consent Flag values in the Expert mode, run one of these commands:

  • grep -n -E "AllowSending|AllowReceiving" /config/db/initial

    Possible returned values: - :<Parameter_Name> 0 - download / upload of data is forbidden - :<Parameter_Name> 1 - download / upload of data is allowed

  • dbget <Parameter_Name>

    Examples: - dbget AllowReceivingDataFromCheckPoint - dbget AllowReceivingDataFromCheckPointNonSecurity - dbget AllowSendingDataToCheckPoint - dbget AllowSendingSensitiveDataToCheckPoint > Possible returned values: - 0 - download / upload of data is forbidden - 1 - download / upload of data is allowed |

| On a Security Gateway / Cluster Member / Security Management Server / Log Server:
$CPDIR/tmp/umis_objects.C
On a Multi-Domain Security Management Server:
$MDSDIR/conf/objects_5_0.C
(Internal Database) | - During the initial start of a Security Gateway / Cluster Member, the fwd process configures the default values in this file.

- On a Security Gateway / Cluster Member, during a policy installation.

- On a Security Management Server / Multi-Domain Security Management Server / Domain Management Server / Log Server, during the first "Install Database" operation. | - The FWD daemon creates this internal database based on the information in the Gaia OS Database or based on the central values from the policy installation.

• Do not edit this file in a text editor. This file is updated automatically during:

  • Each start of the FWD daemon

  • Each policy installation

  • Each database installation operation

• The Consent Flag values are stored in the "DownloadAccess" section in these parameters:

Consent Flag	Parameter Name
Download Security	:allow_download_content (...)
Download Non-Security	:allow_download_non_security_content (...)
Upload Information	:allow_upload_content (...)
Upload Crash Data	:allow_upload_sensitive_content (...)

• To see the current Consent Flag values in the Expert mode, run:

grep -A 10 DownloadAccess $CPDIR/tmp/umis_objects.C | grep ":allow"

Possible returned values:

• :<Parameter_Name> (false) - download / upload of data is forbidden
• :<Parameter_Name> (true) - download / upload of data is allowed |

(5) Known Limitations and Warnings

• On a Management Server, after the Gaia First Time Configuration Wizard, it takes a few minutes for the CPM process to start.

• On a Management Server, before the first "Install Database" operation, it is possible to override the local Consent Flag values with the Gaia Clish commands "set consent-flags". After the first "Install Database" operation or "Install Policy" operation, the values configured in SmartConsole (Global Properties > Data Control Access) take priority.

(6) Troubleshooting

#	Symptoms	Explanation	Next Step
1	1. Gaia Portal > CPUSE page shows this message when you search for a package by its CPUSE Identifier: No package was found Enter full and correct package name 2. The /opt/CPInstLog/DeploymentAgent.log file contains this line for the time of the issue: currently installed license is not entitled to receive updates from CheckPoint download center. FDT error: EntitlementEJB:doProductEntitlement() User Product Entitlement Failure	The current license is expired or not sufficient	Install the correct license
2	1. Gaia Portal > CPUSE page shows this message when you search for a package by its CPUSE Identifier: Download operation isn't approved by the user. Please check your configuration 2. The /opt/CPInstLog/DeploymentAgent.log file contains this line for the time of the issue: [HIGH MSG_DOWNLOADS_NOT_AUTHORIZED]: The administrator did not authorize downloads, not performing update	The administrator disabled the Consent Flag "Download Security"	Enable this Consent Flag to download the "Security" data from online Check Point servers.